test

Author: nielsdos

Zend/zend_vm_def.h

@@ -3153,7 +3153,8 @@ ZEND_VM_HOT_HANDLER(127, ZEND_FE_FREE, TMPVAR, ANY)
 		if (Z_FE_ITER_P(var) != (uint32_t)-1) {
 			zend_hash_iterator_del(Z_FE_ITER_P(var));
 		}
-		zval_ptr_dtor_nogc(var);
+		//zval_ptr_dtor_nogc(var);
+		zval_ptr_dtor(var);
 		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}
 

Zend/zend_vm_execute.h

@@ -115,7 +115,6 @@ U_CFUNC zend_object_iterator *_breakiterator_get_iterator(
 	zoi_iter->zoi.funcs = &breakiterator_iterator_funcs;
 	zoi_iter->zoi.index = 0;
 	zoi_iter->destroy_it = _breakiterator_destroy_it;
-	ZVAL_UNDEF(&zoi_iter->wrapping_obj); /* not used; object is in zoi.data */
 	ZVAL_UNDEF(&zoi_iter->current);
 
 	return reinterpret_cast<zend_object_iterator *>(zoi_iter);
@@ -231,7 +230,7 @@ void IntlIterator_from_BreakIterator_parts(zval *break_iter_zv,
 	ii->iterator->index = 0;
 
 	((zoi_with_current*)ii->iterator)->destroy_it = _breakiterator_parts_destroy_it;
-	ZVAL_OBJ(&((zoi_with_current*)ii->iterator)->wrapping_obj, Z_OBJ_P(object));
+	ZVAL_UNDEF(&((zoi_with_current*)ii->iterator)->wrapping_obj); /* not used; object is in zoi.data */
 	ZVAL_UNDEF(&((zoi_with_current*)ii->iterator)->current);
 
 	((zoi_break_iter_parts*)ii->iterator)->bio = Z_INTL_BREAKITERATOR_P(break_iter_zv);

ext/intl/breakiterator/breakiterator_iterators.cpp

@@ -32,27 +32,38 @@ extern "C" {
 zend_class_entry *IntlIterator_ce_ptr;
 zend_object_handlers IntlIterator_handlers;
 
+static void zoi_with_current_destroy_self(zend_object_iterator *iter, zoi_with_current *zoiwc)
+{
+	/* Object not here anymore (we've been called by the object free handler)
+	 * Note that the iterator wrapper objects (that also depend on this
+	 * structure) call this function earlier, in the destruction phase, which
+	 * precedes the object free phase. Therefore there's no risk on this
+	 * function being called by the iterator wrapper destructor function and
+	 * not finding the memory of this iterator allocated anymore. */
+	iter->funcs->invalidate_current(iter);
+	zoiwc->destroy_it(iter);
+}
+
 void zoi_with_current_dtor(zend_object_iterator *iter)
 {
 	zoi_with_current *zoiwc = (zoi_with_current*)iter;
 
 	if (!Z_ISUNDEF(zoiwc->wrapping_obj)) {
 		/* we have to copy the pointer because zoiwc->wrapping_obj may be
-		 * changed midway the execution of zval_ptr_dtor() */
+		* changed midway the execution of zval_ptr_dtor() */
 		zval *zwo = &zoiwc->wrapping_obj;
 
 		/* object is still here, we can rely on it to call this again and
 		 * destroy this object */
 		zval_ptr_dtor(zwo);
+
+		/* We may only invalidate and destroy if this was actually the last instance.
+		 * If it was, then IntlIterator_objects_free() will have set zwo to UNDEF. */
+		if (Z_ISUNDEF_P(zwo)) {
+			zoi_with_current_destroy_self(iter, zoiwc);
+		}
 	} else {
-		/* Object not here anymore (we've been called by the object free handler)
-		 * Note that the iterator wrapper objects (that also depend on this
-		 * structure) call this function earlier, in the destruction phase, which
-		 * precedes the object free phase. Therefore there's no risk on this
-		 * function being called by the iterator wrapper destructor function and
-		 * not finding the memory of this iterator allocated anymore. */
-		iter->funcs->invalidate_current(iter);
-		zoiwc->destroy_it(iter);
+		zoi_with_current_destroy_self(iter, zoiwc);
 	}
 }
 
@@ -126,6 +137,16 @@ static void string_enum_destroy_it(zend_object_iterator *iter)
 	delete (StringEnumeration*)Z_PTR(iter->data);
 }
 
+static HashTable *string_enum_get_gc(zend_object_iterator *object, zval **table, int *n)
+{
+	zoi_with_current *zoiwc = (zoi_with_current *) object;
+
+	*table = &zoiwc->wrapping_obj;
+	*n = 1;
+
+	return NULL;
+}
+
 static const zend_object_iterator_funcs string_enum_object_iterator_funcs = {
 	zoi_with_current_dtor,
 	zoi_with_current_valid,
@@ -134,7 +155,7 @@ static const zend_object_iterator_funcs string_enum_object_iterator_funcs = {
 	string_enum_current_move_forward,
 	string_enum_rewind,
 	zoi_with_current_invalidate_current,
-	NULL, /* get_gc */
+	string_enum_get_gc,
 };
 
 U_CFUNC void IntlIterator_from_StringEnumeration(StringEnumeration *se, zval *object)
@@ -148,7 +169,8 @@ U_CFUNC void IntlIterator_from_StringEnumeration(StringEnumeration *se, zval *ob
 	ii->iterator->funcs = &string_enum_object_iterator_funcs;
 	ii->iterator->index = 0;
 	((zoi_with_current*)ii->iterator)->destroy_it = string_enum_destroy_it;
-	ZVAL_OBJ(&((zoi_with_current*)ii->iterator)->wrapping_obj, Z_OBJ_P(object));
+	/* This iterator holds a reference to the object, the object may not disappear */
+	ZVAL_OBJ_COPY(&((zoi_with_current*)ii->iterator)->wrapping_obj, Z_OBJ_P(object));
 	ZVAL_UNDEF(&((zoi_with_current*)ii->iterator)->current);
 }
 
@@ -158,6 +180,7 @@ static void IntlIterator_objects_free(zend_object *object)
 
 	if (ii->iterator) {
 		zval *wrapping_objp = &((zoi_with_current*)ii->iterator)->wrapping_obj;
+		/* Signal that it was the last reference that got destroyed */
 		ZVAL_UNDEF(wrapping_objp);
 		zend_iterator_dtor(ii->iterator);
 	}
@@ -166,6 +189,22 @@ static void IntlIterator_objects_free(zend_object *object)
 	zend_object_std_dtor(&ii->zo);
 }
 
+static HashTable *IntlIterator_get_gc(zend_object *object, zval **table, int *n)
+{
+	IntlIterator_object *ii = php_intl_iterator_fetch_object(object);
+
+	if (ii->iterator) {
+		zend_get_gc_buffer *gc = zend_get_gc_buffer_create();
+		zend_get_gc_buffer_add_obj(gc, &ii->iterator->std);
+		zend_get_gc_buffer_use(gc, table, n);
+	} else {
+		*table = NULL;
+		*n = 0;
+	}
+
+	return NULL;
+}
+
 static zend_object_iterator *IntlIterator_get_iterator(
 	zend_class_entry *ce, zval *object, int by_ref)
 {
@@ -293,6 +332,7 @@ U_CFUNC void intl_register_common_symbols(int module_number)
 	IntlIterator_handlers.offset = XtOffsetOf(IntlIterator_object, zo);
 	IntlIterator_handlers.clone_obj = NULL;
 	IntlIterator_handlers.free_obj = IntlIterator_objects_free;
+	IntlIterator_handlers.get_gc = IntlIterator_get_gc;
 
 	register_common_symbols(module_number);
 }